CVE-2026-63140

Received Received - Intake

Reachable Assertion in Elasticsearch Leads to DoS

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: Elastic

Description

Reachable Assertion (CWE-617) in Elasticsearch can lead to denial of service via Input Data Manipulation (CAPEC-153). A specially crafted search request containing a null value in a specific query clause causes an internal assertion to be raised during query parsing. Because Elasticsearch treats assertion failures as fatal errors, this terminates the affected node process. A low-privileged authenticated user with read access to at least one index can exploit this condition with a single request to cause a node to terminate, disrupting search availability. In a single-node deployment this fully stops Elasticsearch; in a multi-node cluster it reduces cluster capacity for each affected node.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-21

Last Modified

2026-07-21

Generated

2026-07-22

AI Q&A

2026-07-22

EPSS Evaluated

N/A

NVD

CVE-2026-63140

Affected Vendors & Products

Vendor	Product	Version / Range
elastic	elasticsearch	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-617	The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

Executive Summary

This is a Reachable Assertion vulnerability (CWE-617) in Elasticsearch that allows denial of service through input manipulation. A crafted search request with a null value in a specific query clause triggers an internal assertion failure during parsing. Elasticsearch treats such failures as fatal, causing the affected node to terminate. This requires only low-privileged authenticated read access to at least one index.

Detection Guidance

This vulnerability can be detected by monitoring for unexpected Elasticsearch node terminations or crashes. Check Elasticsearch logs for assertion errors or fatal crashes, particularly after processing search requests. Look for logs containing 'assertion failure' or 'fatal error' in the Elasticsearch log directory, typically found in /var/log/elasticsearch/. No specific commands are provided for detection.

Impact Analysis

The impact includes service disruption where Elasticsearch nodes terminate unexpectedly. In single-node setups, this stops Elasticsearch completely. In multi-node clusters, each affected node reduces overall cluster capacity. Attackers can exploit this with a single request to cause availability issues for search operations.

Mitigation Strategies

Apply the latest Elasticsearch security patch immediately. Restrict read access to indices for low-privileged users. Monitor cluster health and node status for signs of crashes. Consider temporarily disabling affected query clauses if a patch is not immediately available.

Hi! I’m here to help you understand CVE-2026-63140. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70